Examkin

Question

Difficulty: HardCreate and Configure Azure Functions

A financial services company is deploying an event-driven application using Azure Functions V4. The application includes a function that processes incoming queue messages from an Azure Service Bus namespace. The security architecture mandates that the Function App must connect to the Service Bus namespace using its system-assigned managed identity, completely eliminating the use of connection strings, shared access signature (SAS) keys, or secrets. The Service Bus trigger in the function code is configured with Connection = "ServiceBusConnection". Which of the following configuration steps must be implemented to establish this identity-based connection? (Select TWO)

  1. Assign the Azure Service Bus Data Receiver role to the system-assigned managed identity of the Function App.Answer
  2. Add an application setting named ServiceBusConnection__fullyQualifiedNamespace and set its value to the fully qualified domain name of the Service Bus namespace.Answer
  3. C
    Assign the Azure Service Bus Contributor role to the system-assigned managed identity of the Function App.
  4. D
    Add an application setting named ServiceBusConnection__clientId and set its value to the Client ID of the system-assigned managed identity.

Answer

To establish the identity-based connection, you must assign the Azure Service Bus Data Receiver role to the system-assigned managed identity of the Function App and add an application setting named ServiceBusConnection__fullyQualifiedNamespace set to the fully qualified domain name of the Service Bus namespace.
Establishing an identity-based connection requires configuring both the application host configuration and data-plane access. Specifying the ServiceBusConnection__fullyQualifiedNamespace setting directs the Function App to target the correct namespace without requiring secrets. Assigning the Azure Service Bus Data Receiver role ensures that the system-assigned managed identity has the necessary permission to consume messages from the queues within the namespace.

Step-by-Step Solution

1
Assign the data-plane access role to the managed identity.
The system-assigned managed identity is granted the Azure Service Bus Data Receiver role on the Service Bus namespace level.
Azure Functions triggers require data-plane access to retrieve and process queue messages. Management-plane roles like Contributor are insufficient.
2
Configure the Connection setting using the fullyQualifiedNamespace suffix in the app settings.
The application setting ServiceBusConnection__fullyQualifiedNamespace is added with the value of the Service Bus namespace host name (e.g., mysbnamespace.servicebus.windows.net).
Azure Functions V4 uses the __fullyQualifiedNamespace suffix on the connection name prefix to resolve the endpoint when using an identity-based connection instead of a connection string.

Key Concept

Identity-based connections in Azure Functions V4
Rate this question

Topics

Create and Configure Azure Functions

More questions from this topic